[prev in list] [next in list] [prev in thread] [next in thread] 

List:       netfilter
Subject:    Re: ipv6 rule icmp bug maybe
From:       Pascal Hambourg <pascal () plouf ! fr ! eu ! org>
Date:       2013-04-07 9:15:12
Message-ID: 51613920.7010203 () plouf ! fr ! eu ! org
[Download RAW message or body]

Hello,

Nick Edwards a écrit :
> 
> /usr/sbin/ip6tables -A INPUT -s fe80::/10 -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -d ff00::/8 -j ACCEPT
> 
> /usr/sbin/iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
> /usr/sbin/iptables -A INPUT -s 178.x.x.x/24 -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -s 2001:c01d:c01d:beef::0/64 -j ACCEPT
> 
> /usr/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> /usr/sbin/ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

If the network interface is of ethernet type, you should allow ICMPv6
types neighbour solicitation and neighbour advertisement. They replace
ARP requests and replies for IPv6.

> however, when I come from the ipv6 range, I can ssh in, but I can not ping it.

What do you mean by "can not ping" ? What happens exactly ? Have you
done a packet capture on both ends to see what happens at the network
layer ?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
[prev in list] [next in list] [prev in thread] [next in thread]